GA4
The Data API runReport call is a POST, so a stored secret cannot be sent. Use a sheet or push.
What you can track
Active users, sessions, event count and conversions, after they land in the KPI sheet or on the push address. A Google Apps Script or a scheduled Looker/Sheets export is the usual writer. The template’s “Active users” column is the right shape.
Credential
None in tlly for the sheet or the push.
The Data API itself is POST https://analyticsdata.googleapis.com/v1beta/properties/PROPERTY_ID:runReport with OAuth scope https://www.googleapis.com/auth/analytics.readonly (or https://www.googleapis.com/auth/analytics, which is broader; prefer readonly). tlly will not send a stored secret on that POST. It is not GraphQL and it is not HubSpot search. Do not create that job.
Where to get it
For the supported path: the Sheets template, filled by a script in the user’s Google account. Property id is the numeric GA4 property id, only needed inside that script.
tlly job
The Sheets job with "value":"Active users" (or the column the script writes).
Gotchas
- runReport returns a table (dimensionValues, metricValues), which this playbook does not map, because the call cannot be made with a secret.
- Do not ask the chat to collect a Google OAuth refresh token.
Alert ideas
Red when active users drop below the last month’s floor. Yellow when a conversion event’s count is zero.
Verification
Checked 2026-10-26: method POST, the URL shape, and the two OAuth scopes on the runReport reference. No request body was copied into a job, because tlly cannot send it with a secret.